1. Field of the Invention
The present invention relates to electronic computer systems generally and, more particularly, to a novel method and means of limiting access to such computer systems and especially those systems which require the input of a security code, or password, as part of the procedure to access such systems.
2. Background Art
Electronic data bases are widely used in a broad range of activities and typically are maintained in various memory devices of computer systems. Such data bases may be used for work-in-process control in manufacturing, pricing and inventory control in selling, ticket issuance, and data storage in research, to name only a very small number of actual uses. Often, and especially in larger data systems, the computer system in which the data bases are maintained has included in it a number of CRT terminals which may be used to both input and access data to and from the memory devices. This arrangement greatly facilitates the operation of an organization by allowing rapid input and access by a number of persons. While this is advantageous, there are many situations in which it is desired to limit access to the data bases and programs to only those persons to whom such access is authorized.
Conventionally, access to data bases is limited by means of having a potential user type in a security code at one of the CRT terminals to "unlock" access to the data bases. A problem with this method is that an unauthorized person may simply observe the keys pressed to enter the security code. As an alternative method, the potential user may insert a personal identification card with a bar code, magnetic code, or other coded identification in a slot card reader. One problem with either method is that, later, an unauthorized person can simply put the CRT terminal in "TEST MODE" to read the security code and then use the security code to gain access to the data bases. It is therefore necessary to ensure that the security code is deleted, or the terminal locked out, whenever the authorized person leaves the terminal. Frequently, the program requires that the user log out when finished, but often the users forget to log out. One conventional technique to achieve automatic log out is to have a "time out" period built into the computer program with which the terminal is locked out after a predetermined interval of time during which there has been no entry on the keyboard. A disadvantage of this technique is that the "time out" period must be set fairly long to allow for slow users or users may stop to think for a period of time in excess of the "time out" period. Another problem with the foregoing methods is that the authorized person may give his security code to the unauthorized person.
A further problem with methods which employ an identification card with the security code encrypted on it in bar code form is that the card may simply be copied by conventional photocopying techniques or, if the bar code is encrypted according to standard symbologies, it may be forged through the use of a standard bar code printer.
Another problem with computer access could arise in situations in which one person would be required to "sign in" on a CRT terminal each time an event occured. One such situation is with "paperless inspections" in which it would be desirable to avoid the large amount of paperwork required. For example, if an airplane is being repaired, an inspector would inspect each repair, access a host computer through a CRT terminal using his coded identification card, and then enter data indicating that the repair had been satisfactorily made and inspected. Another such situation is one which requires a supervisor to authorize the ordering of parts each time parts are ordered. Here, it would be desirable that the supervisor acess a host computer in the same way as the above inspector and then indicate that the ordering of a part is authorized. A problem with either of the two foregoing example situations is that the inspector or supervisor may want to avoid the inconvenience of having to continually go to the CRT terminal and access the host computer and may, therefore, simply log in to the host computer, remove his identification card, and allow the mechanic, the parts person, or others to enter data into the host computer. The card cannot be left in the card reader because it is needed as a personal identification card for the presence of, or access by, the inspector or supervisor in or to secured areas.
The foregoing problem can be eliminated by detecting when the identification card is removed from the reader by optically detecting the passage of a bar code, for example, and immediately terminating access to the host computer, but this method of detection can be foiled by a person inserting a piece of paper in the reader slot before removing the identification card. Thus, the reader continues to output a signal to the CRT terminal indicating that the card is still in the slot.
Accordingly, it is a principal object of the present invention to provide a method and means for eliminating manual entry of security codes while defeating the use of a security code by an unauthorized person.
It is an additional object of the invention to provide a method and means to prevent tampering with an identification card reader and detecting when an identification card has been removed from a reader.
It is a further object of the invention to provide a method and means to check the validity of an identification card and to prevent copying or forging of the card.
It is another object of the invention to provide a method and means to prevent copying or forging of a transmission to a host computer.
Yet an additional object of the invention is to provide any of such methods and means which can be easily retrofitted to existing systems with minor hardware changes and little or no changes to existing host computer software.
Other objects of the present invention, as well as particular features and advantages thereof, will be elucidated in, or be apparent from, the following description and the accompanying drawing figure.